qcacld-3.0: Prevent possible use-after-free of ipa_obj

wlan_ipa_uc_loaded_uc_cb is an API that is registered to IPA driver.
Therefore when IPA uC is ready, IPA driver is likely to invoke this CB
into our driver. If it is invoked after a WLAN idle shutdown, ipa_obj
use-after-free will happen because ipa_obj is destroyed as part of
shutdown.

g_ipa_is_ready flag is cleared after ipa_obj is destroyed. Therefore
fix is to add a ipa_cb_is_ready check in wlan_ipa_uc_loaded_uc_cb to
ensure ipa_obj is allocated and not freed.

Change-Id: Id422c0780ab864936d9bc812a6078ea4c20ef2af
CRs-Fixed: 2975057

components/ipa/core/src/wlan_ipa_core.c

@@ -144,6 +144,11 @@ static void wlan_ipa_uc_loaded_uc_cb(void *priv_ctxt)
 	struct op_msg_type *msg;
 	struct uc_op_work_struct *uc_op_work;
 
+	if (!ipa_cb_is_ready()) {
+		ipa_info("IPA is not READY");
+		return;
+	}
+
 	if (!priv_ctxt) {
 		ipa_err("Invalid IPA context");
 		return;

components/ipa/dispatcher/src/wlan_ipa_obj_mgmt_api.c

@@ -182,6 +182,7 @@ static void ipa_register_ready_cb(void *user_data)
 						      WLAN_UMAC_COMP_IPA,
 						      ipa_obj);
 		qdf_mem_free(ipa_obj);
+		ipa_disable_register_cb();
 		goto out;
 	}
 	if (ucfg_ipa_uc_ol_init(pdev, qdf_dev)) {